Skip to content

Commit 263de44

Browse files
eclipxe13eclipxe13
authored
Merge pull request #17 from celli33/main
Feat: added pkcs12 support
2 parents e5387ed + db783d7 commit 263de44

10 files changed

+362
-13
lines changed

‎.phive/phars.xml

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
<?xml version="1.0" encoding="UTF-8"?>
22
<phive xmlns="https://phar.io/phive">
33
<phar name="php-cs-fixer" version="^3.14.4" installed="3.14.4" location="./tools/php-cs-fixer" copy="false"/>
4-
<phar name="phpcs" version="^3.7.1" installed="3.7.1" location="./tools/phpcs" copy="false"/>
5-
<phar name="phpcbf" version="^3.7.1" installed="3.7.1" location="./tools/phpcbf" copy="false"/>
6-
<phar name="phpstan" version="^1.10.1" installed="1.10.1" location="./tools/phpstan" copy="false"/>
4+
<phar name="phpcs" version="^3.7.2" installed="3.7.2" location="./tools/phpcs" copy="false"/>
5+
<phar name="phpcbf" version="^3.7.2" installed="3.7.2" location="./tools/phpcbf" copy="false"/>
6+
<phar name="phpstan" version="^1.10.2" installed="1.10.2" location="./tools/phpstan" copy="false"/>
77
<phar name="composer-normalize" version="^2.29.0" installed="2.29.0" location="./tools/composer-normalize" copy="false"/>
88
</phive>

‎README.md

+43-1
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ echo $certificado->serialNumber()->bytes(), PHP_EOL; // número de serie del cer
6969
## Acerca de los archivos de certificado y llave privada
7070

7171
Los archivos de certificado vienen en formato `X.509 DER` y los de llave privada en formato `PKCS#8 DER`.
72-
Ambos formatos no se pueden interpretar directamente en PHP (con `ext-openssl`), sin embargo sí lo pueden hacer
72+
Ambos formatos no se pueden interpretar directamente en PHP (con `ext-openssl`), sin embargo, sí lo pueden hacer
7373
en el formato compatible [`PEM`](https://en.wikipedia.org/wiki/Privacy-Enhanced_Mail).
7474

7575
Esta librería tiene la capacidad de hacer esta conversión internamente (sin `openssl`), pues solo consiste en codificar
@@ -119,6 +119,48 @@ Notas de tratamiento de archivos `DER`:
119119
Para entender más de los formatos de llaves privadas se puede consultar la siguiente liga:
120120
<https://github.com/kjur/jsrsasign/wiki/Tutorial-for-PKCS5-and-PKCS8-PEM-private-key-formats-differences>
121121

122+
## Leer y exportar archivos PFX
123+
124+
Esta librería soporta obtener el objeto `Credential` desde un archivo PFX (PKCS #12) y vicerversa.
125+
126+
Para exportar el archivo PFX:
127+
128+
```php
129+
<?php declare(strict_types=1);
130+
131+
use PhpCfdi\Credentials\Pfx\PfxExporter;
132+
133+
$credential = PhpCfdi\Credentials\Credential::openFiles(
134+
'certificate/certificado.cer',
135+
'certificate/private-key.key',
136+
'password'
137+
);
138+
139+
$pfxExporter = new PfxExporter($credential);
140+
141+
// crea el binary string usando la contraseña dada
142+
$pfxContents = $pfxExporter->export('pfx-passphrase');
143+
144+
// guarda el archivo pfx a la ruta local dada usando la contraseña dada
145+
$pfxExporter->exportToFile('credential.pfx', 'pfx-passphrase');
146+
```
147+
148+
Para leer el archivo PFX y obtener un objeto `Credential`:
149+
150+
```php
151+
<?php declare(strict_types=1);
152+
153+
use PhpCfdi\Credentials\Pfx\PfxReader;
154+
155+
$pfxReader = new PfxReader();
156+
157+
// crea un objeto Credential dado el contenido de un archivo pfx
158+
$credential = $pfxReader->createCredentialFromContents('contenido-del-archivo', 'pfx-passphrase');
159+
160+
// crea un objeto Credential dada la ruta local de un archivo pfx
161+
$credential = $pfxReader->createCredentialsFromFile('pfxFilePath', 'pfx-passphrase');
162+
```
163+
122164
## Compatibilidad
123165

124166
Esta librería se mantendrá compatible con al menos la versión con

‎docs/CHANGELOG.md

+11-4
Original file line numberDiff line numberDiff line change
@@ -9,11 +9,20 @@ Usamos [Versionado Semántico 2.0.0](SEMVER.md) por lo que puedes usar esta libr
99
Pueden aparecer cambios no liberados que se integran a la rama principal, pero no ameritan una nueva liberación de
1010
versión, aunque sí su incorporación en la rama principal de trabajo. Generalmente, se tratan de cambios en el desarrollo.
1111

12-
### Mantenimiento 2023-02-22
12+
## Listado de cambios
13+
14+
### Versión 1.2.0 2023-02-24
15+
16+
Se agrega la funcionalidad para exportar (`PfxExporter`) y leer (`PfxReader`) una credencial con formato PKCS#12 (PFX).
17+
Gracias `@celli33` por tu contribución.
18+
19+
Los siguientes cambios ya estaban incluidos en la rama principal:
20+
21+
#### Mantenimiento 2023-02-22
1322

1423
Los siguientes cambios son de mantenimiento:
1524

16-
- Se actualiza el año en el archivo de licencia.
25+
- Se actualiza el año en el archivo de licencia. ¡Feliz 2023!
1726
- Se agrega una prueba para comprobar certificados *Teletex*.
1827
Ver https://github.com/nodecfdi/credentials/commit/cd8f1827e06a5917c41940e82b8d696379362d5d.
1928
- Se agrega un archivo de documentación: *Ejemplo de creación de una credencial con verificaciones previas*.
@@ -28,8 +37,6 @@ Los siguientes cambios son de mantenimiento:
2837
- Se corrige el trabajo `phpcs` eliminando las rutas fijas.
2938
- Se actualizan las versiones de las herramientas de desarrollo.
3039

31-
## Listado de cambios
32-
3340
### Versión 1.1.4 2022-01-31
3441

3542
- Se mejora la forma en como son procesados los tipos de datos del certificado.

‎src/Pfx/PfxExporter.php

+70
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
<?php
2+
3+
declare(strict_types=1);
4+
5+
namespace PhpCfdi\Credentials\Pfx;
6+
7+
use PhpCfdi\Credentials\Credential;
8+
use PhpCfdi\Credentials\Internal\LocalFileOpenTrait;
9+
use RuntimeException;
10+
11+
class PfxExporter
12+
{
13+
use LocalFileOpenTrait;
14+
15+
/** @var Credential $credential */
16+
private $credential;
17+
18+
public function __construct(Credential $credential)
19+
{
20+
$this->credential = $credential;
21+
}
22+
23+
public function getCredential(): Credential
24+
{
25+
return $this->credential;
26+
}
27+
28+
public function export(string $passPhrase): string
29+
{
30+
$pfxContents = '';
31+
/** @noinspection PhpUsageOfSilenceOperatorInspection */
32+
$success = @openssl_pkcs12_export(
33+
$this->credential->certificate()->pem(),
34+
$pfxContents,
35+
[$this->credential->privateKey()->pem(), $this->credential->privateKey()->passPhrase()],
36+
$passPhrase,
37+
);
38+
if (! $success) {
39+
throw $this->exceptionFromLastError(sprintf(
40+
'Cannot export credential with certificate %s',
41+
$this->credential->certificate()->serialNumber()->bytes()
42+
));
43+
}
44+
return $pfxContents;
45+
}
46+
47+
public function exportToFile(string $pfxFile, string $passPhrase): void
48+
{
49+
/** @noinspection PhpUsageOfSilenceOperatorInspection */
50+
$success = @openssl_pkcs12_export_to_file(
51+
$this->credential->certificate()->pem(),
52+
$pfxFile,
53+
[$this->credential->privateKey()->pem(), $this->credential->privateKey()->passPhrase()],
54+
$passPhrase
55+
);
56+
if (! $success) {
57+
throw $this->exceptionFromLastError(sprintf(
58+
'Cannot export credential with certificate %s to file %s',
59+
$this->credential->certificate()->serialNumber()->bytes(),
60+
$pfxFile
61+
));
62+
}
63+
}
64+
65+
private function exceptionFromLastError(string $message): RuntimeException
66+
{
67+
$previousError = error_get_last() ?? [];
68+
return new RuntimeException(sprintf('%s: %s', $message, $previousError['message'] ?? '(Unknown reason)'));
69+
}
70+
}

‎src/Pfx/PfxReader.php

+45
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
<?php
2+
3+
declare(strict_types=1);
4+
5+
namespace PhpCfdi\Credentials\Pfx;
6+
7+
use PhpCfdi\Credentials\Credential;
8+
use PhpCfdi\Credentials\Internal\LocalFileOpenTrait;
9+
use UnexpectedValueException;
10+
11+
class PfxReader
12+
{
13+
use LocalFileOpenTrait;
14+
15+
public function createCredentialFromContents(string $contents, string $passPhrase): Credential
16+
{
17+
if ('' === $contents) {
18+
throw new UnexpectedValueException('Cannot create credential from empty PFX contents');
19+
}
20+
$pfx = $this->loadPkcs12($contents, $passPhrase);
21+
$certificatePem = $pfx['cert'];
22+
$privateKeyPem = $pfx['pkey'];
23+
return Credential::create($certificatePem, $privateKeyPem, '');
24+
}
25+
26+
public function createCredentialFromFile(string $fileName, string $passPhrase): Credential
27+
{
28+
return $this->createCredentialFromContents(self::localFileOpen($fileName), $passPhrase);
29+
}
30+
31+
/**
32+
* @return array{cert:string, pkey:string}
33+
*/
34+
public function loadPkcs12(string $contents, string $password = ''): array
35+
{
36+
$pfx = [];
37+
if (! openssl_pkcs12_read($contents, $pfx, $password)) {
38+
throw new UnexpectedValueException('Invalid PKCS#12 contents or wrong passphrase');
39+
}
40+
return [
41+
'cert' => $pfx['cert'] ?? '',
42+
'pkey' => $pfx['pkey'] ?? '',
43+
];
44+
}
45+
}

‎tests/Unit/Pfx/PfxExporterTest.php

+107
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
<?php
2+
3+
declare(strict_types=1);
4+
5+
namespace PhpCfdi\Credentials\Tests\Unit\Pfx;
6+
7+
use PhpCfdi\Credentials\Certificate;
8+
use PhpCfdi\Credentials\Credential;
9+
use PhpCfdi\Credentials\Pfx\PfxExporter;
10+
use PhpCfdi\Credentials\Pfx\PfxReader;
11+
use PhpCfdi\Credentials\PrivateKey;
12+
use PhpCfdi\Credentials\Tests\TestCase;
13+
use RuntimeException;
14+
15+
class PfxExporterTest extends TestCase
16+
{
17+
/** @var string */
18+
private $credentialPassphrase;
19+
20+
protected function setUp(): void
21+
{
22+
parent::setUp();
23+
$this->credentialPassphrase = trim($this->fileContents('CSD01_AAA010101AAA/password.txt'));
24+
}
25+
26+
private function createCredential(): Credential
27+
{
28+
return Credential::openFiles(
29+
$this->filePath('CSD01_AAA010101AAA/certificate.cer'),
30+
$this->filePath('CSD01_AAA010101AAA/private_key.key'),
31+
$this->credentialPassphrase
32+
);
33+
}
34+
35+
public function testExport(): void
36+
{
37+
$credential = $this->createCredential();
38+
$pfxExporter = new PfxExporter($credential);
39+
40+
$pfxContents = $pfxExporter->export('');
41+
42+
$reader = new PfxReader();
43+
$this->assertSame(
44+
$reader->loadPkcs12($this->fileContents('CSD01_AAA010101AAA/credential_unprotected.pfx')),
45+
$reader->loadPkcs12($pfxContents)
46+
);
47+
}
48+
49+
public function testExportToFile(): void
50+
{
51+
$credential = $this->createCredential();
52+
$pfxExporter = new PfxExporter($credential);
53+
$temporaryFile = tempnam('', '');
54+
if (false === $temporaryFile) {
55+
$this->fail('Expected to create a temporary file');
56+
}
57+
58+
$pfxExporter->exportToFile($temporaryFile, '');
59+
60+
$reader = new PfxReader();
61+
$this->assertSame(
62+
$reader->loadPkcs12($this->fileContents('CSD01_AAA010101AAA/credential_unprotected.pfx')),
63+
$reader->loadPkcs12((string) file_get_contents($temporaryFile))
64+
);
65+
}
66+
67+
public function testExportWithError(): void
68+
{
69+
// create a credential with an invalid private key to produce error
70+
$certificate = Certificate::openFile($this->filePath('CSD01_AAA010101AAA/certificate.cer'));
71+
$privateKey = $this->createMock(PrivateKey::class);
72+
$privateKey->method('belongsTo')->willReturn(true);
73+
$privateKey->method('pem')->willReturn('bar');
74+
$privateKey->method('passPhrase')->willReturn('baz');
75+
$malformedCredential = new Credential($certificate, $privateKey);
76+
77+
$pfxExporter = new PfxExporter($malformedCredential);
78+
79+
$this->expectException(RuntimeException::class);
80+
$this->expectExceptionMessageMatches(
81+
'#^Cannot export credential with certificate 30001000000300023708: #'
82+
);
83+
84+
$pfxExporter->export('');
85+
}
86+
87+
public function testExportToFileWithError(): void
88+
{
89+
$credential = $this->createCredential();
90+
$pfxExporter = new PfxExporter($credential);
91+
$exportFile = __DIR__ . '/non-existent/path/file.pfx';
92+
93+
$this->expectException(RuntimeException::class);
94+
$this->expectExceptionMessageMatches(
95+
"#^Cannot export credential with certificate 30001000000300023708 to file $exportFile: #"
96+
);
97+
$pfxExporter->exportToFile($exportFile, '');
98+
}
99+
100+
public function testGetCredential(): void
101+
{
102+
$credential = $this->createCredential();
103+
$pfxExporter = new PfxExporter($credential);
104+
105+
$this->assertSame($credential, $pfxExporter->getCredential());
106+
}
107+
}

‎tests/Unit/Pfx/PfxReaderTest.php

+72
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
<?php
2+
3+
declare(strict_types=1);
4+
5+
namespace PhpCfdi\Credentials\Tests\Unit\Pfx;
6+
7+
use PhpCfdi\Credentials\Credential;
8+
use PhpCfdi\Credentials\Pfx\PfxReader;
9+
use PhpCfdi\Credentials\Tests\TestCase;
10+
use UnexpectedValueException;
11+
12+
class PfxReaderTest extends TestCase
13+
{
14+
private function obtainKnownCredential(): Credential
15+
{
16+
$reader = new PfxReader();
17+
return $reader->createCredentialFromFile(
18+
$this->filePath('CSD01_AAA010101AAA/credential_unprotected.pfx'),
19+
''
20+
);
21+
}
22+
23+
/**
24+
* @testWith ["CSD01_AAA010101AAA/credential_unprotected.pfx", ""]
25+
* ["CSD01_AAA010101AAA/credential_protected.pfx", "CSD01_AAA010101AAA/password.txt"]
26+
*/
27+
public function testCreateCredentialFromFile(string $dir, string $passPhrasePath): void
28+
{
29+
$passPhrase = $this->fileContents($passPhrasePath);
30+
$reader = new PfxReader();
31+
$expectedCsd = $this->obtainKnownCredential();
32+
33+
$csd = $reader->createCredentialFromFile($this->filePath($dir), $passPhrase);
34+
35+
$this->assertInstanceOf(Credential::class, $csd);
36+
$this->assertSame($expectedCsd->certificate()->pem(), $csd->certificate()->pem());
37+
$this->assertSame($expectedCsd->privateKey()->pem(), $csd->privateKey()->pem());
38+
}
39+
40+
public function testCreateCredentialEmptyContents(): void
41+
{
42+
$reader = new PfxReader();
43+
44+
$this->expectException(UnexpectedValueException::class);
45+
$this->expectExceptionMessage('Cannot create credential from empty PFX contents');
46+
47+
$reader->createCredentialFromContents('', '');
48+
}
49+
50+
public function testCreateCredentialWrongContent(): void
51+
{
52+
$reader = new PfxReader();
53+
54+
$this->expectException(UnexpectedValueException::class);
55+
$this->expectExceptionMessage('Invalid PKCS#12 contents or wrong passphrase');
56+
57+
$reader->createCredentialFromContents('invalid-contents', '');
58+
}
59+
60+
public function testCreateCredentialWrongPassword(): void
61+
{
62+
$reader = new PfxReader();
63+
64+
$this->expectException(UnexpectedValueException::class);
65+
$this->expectExceptionMessage('Invalid PKCS#12 contents or wrong passphrase');
66+
67+
$reader->createCredentialFromFile(
68+
$this->filePath('CSD01_AAA010101AAA/credential_protected.pfx'),
69+
'wrong-password'
70+
);
71+
}
72+
}

‎tests/_files/CSD01_AAA010101AAA/credential_protected.pfx

3.21 KB
Binary file not shown.

‎tests/_files/CSD01_AAA010101AAA/credential_unprotected.pfx

3.21 KB
Binary file not shown.

0 commit comments

Comments
 (0)